CVE-2025-61676 - October CMS Vulnerable to Stored XSS via Branding Styles - 2025 Update

CVE ID : CVE-2025-61676 Published : Jan. 10, 2026, 4:16 a.m. | 1 hour, 19 minutes ago Description : October is a Content Management System (CMS) and web platform. Prior to versions 3.7.13 and 4.0.12, a cross-site scripting (XSS) vulnerabilities was identified in October CMS backend configuration forms. A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Styles from Branding & Appearance settings. A specially crafted input could break out of the intended

Source: Telegram CVE Monitor